CVE-2026-73954
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise PeopleTools (Business Interlink component). Difficult to exploit, but an unauthenticated attacker with network access via HTTP can compromise the system. High impact on confidentiality, integrity, and availability.
Risk Assessment
Compromise of PeopleTools could lead to full compromise of PeopleSoft system, including data access and disruption.
Recommendation
Apply patches from Oracle. Restrict network access to PeopleSoft services and monitor for suspicious activities.
Other vulnerabilities in PeopleSoft Enterprise PeopleTools
See all- CVE-2017-10364High
Vulnerability in the PeopleTools component of Oracle PeopleSoft Enterprise allows low privileged attackers to access critical data. Versions 8.54, 8.55, and 8.56 are susceptible to easily exploitable attacks via HTTP.
- CVE-2017-3519High
A vulnerability in the PeopleTools component of Oracle PeopleSoft Products allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all data accessible in PeopleSoft Enterprise PeopleTools.
- CVE-2016-8291High
Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Application Platform.
- CVE-2016-5472High
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows local users to affect confidentiality, integrity, and availability via vectors related to Install and Packaging.
- CVE-2016-5465High
Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Panel Processor.
- CVE-2026-60821Critical
Vulnerability in PeopleSoft Enterprise PeopleTools (Business Interlink component) versions 8.61-8.63. Easily exploitable by unauthenticated attacker with network access via HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-35273CriticalActively exploited
A vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Updates Environment Management). Affects versions 8.61 and 8.62. Easily exploitable, allows an unauthenticated attacker via HTTP to take over PeopleSoft Enterprise PeopleTools.
- CVE-2026-87264High
Vulnerability in PeopleSoft Enterprise PeopleTools (component: Integration Broker) affecting versions 8.61-8.63. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to create, delete or modify data, and the attack may significantly impact additional products (scope change).
- CVE-2026-83019High
Vulnerability in PeopleSoft Enterprise PeopleTools (component: SQR) affects versions 8.61-8.63. It is easily exploitable by low-privileged attacker via HTTP network access. Can lead to unauthorized access to critical data and complete denial of service.
- CVE-2026-83018High
Vulnerability in PeopleSoft Enterprise PeopleTools (component: SQR) affects versions 8.61-8.63. It is easily exploitable by low-privileged attacker with logon to infrastructure. Successful attack can lead to takeover of PeopleTools.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS